Feature extraction and selection methods used in detecting distributed denial of service attacks

This study presents a comparative evaluation of the effectiveness of feature extraction and selection methods in detecting DDoS (Distributed Denial of Service) attacks. The dataset used is the ISCXIDS 2012 attack detection evaluation dataset. The study systematically addresses the steps of data preprocessing, feature extraction, and selection. First, the dataset was prepared for numerical analyses, and imbalances were resolved to ensure an equal number of normal and attack samples. Subsequently, Principal Component Analysis (PCA), Autoencoders, and Stacked Autoencoders were employed for feature extraction. As the number of components extracted using PCA increased, significant improvements were observed in model accuracy and F1-score performance. Autoencoders and Stacked Autoencoders demonstrated strong performance by reducing feature dimensions using deep learning techniques. In the feature selection step, Chi-Square Test and Recursive Feature Elimination (RFE) methods were employed. The RFE method iteratively analyzed the importance of features and achieved high performance with the Support Vector Machine (SVM) model. The results showed that feature extraction methods like PCA and Autoencoders significantly preserved accuracy and F1-score values while reducing computational costs compared to the original dataset. From a machine learning perspective, the comparison results indicated that SVM and Neural Network models exhibited the highest performance, particularly after dimension reduction using PCA and Autoencoders. The Logistic Regression model experienced a slight performance decline initially but matched the original dataset's performance as the number of components increased. In conclusion, this study demonstrated that the processes of feature extraction and selection play a critical role in optimizing model performance for DDoS attack detection. For future work, detailed analyses of these methods on different datasets and with hyperparameter optimization are recommended to further enhance their effectiveness.